Record security for search lists is something that needs to specifically be configured in your database if you choose to use site or constituent security - by default, it is not enabled.  To configure it, add the following to the web.config file:

<add key="RECORDSECURITY_ENABLED_FOR_SEARCHLIST" value="True"/>